Tag Info

Hot answers tagged

42

There is no "patch". It's a vulnerability in the protocol, not a bug in the implementation. In Windows Server 2003 to 2012 R2 the SSL / TLS protocols are controlled by flags in the registry set at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols. To disable SSLv3, which the POODLE vulnerability is concerned with, ...


26

A person with administrative (or often even physical) access to a server is going to be able to extract the private key. Whether through exporting, memory sniffing, or other such trickery. Your administrators have access to the private keys of your web servers. Accept this as fact, and work around that. If your sysadmins aren't trustworthy, then you may ...


17

Just for ease of installation I derived this "disable ssl 2 and 3.reg" file from Evan's answer above: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] "Enabled"=dword:00000000 ...


17

If you're not using IIS, you absolutely should remove it, for the reasons you mentioned - maintenance and security. The only effect of removing IIS is an inability to use IIS. No management or operational side effects - it hasn't been entrenched into the operating system like Internet Explorer has. Of the over 250 Windows servers I manage, less than 10 ...


13

There are a number of things that could be causing this - unfortunately, we probably need a bit more information. Before I get into my actual response, just a quick point on your HTML pages: generally speaking, the application pool can only respond to a certain number of requests at a time. If it is busy responding to requests for dynamic pages, then it may ...


13

No. Microsoft offers an FTP over SSL (FTPS) solution but does not currently provide a solution for securing FTP traffic using FTP over SSH (SFTP)


12

The only overhead incurred will be the few bytes taken up in applicationHost.config to define the Application Pools and any non-default settings they may have. If you have a 1000 unused app pools it might improve the time it takes to apply on-the-fly configuration changes to IIS (since there's less XML for the WAS service to parse), but with 5 App Pools I ...


11

When you import the key, you have the option of marking it as non-exportable. This will prevent you from using IIS or the certificate MMC to export it. At least, it makes it a little harder. However, if they have an administrator account on the machine, or have physical access to it - they will still be able to get the key through other means.


10

Neither the Microsoft IIS server, nor Windows itself, support SFTP (or SSH) at all, on any version of IIS or Windows. IIS supports secure FTP (FTPS or FTP over TLS/SSL) though. It's a different (incompatible) protocol than SFTP, but most "FTP" clients support both SFTP and FTPS. When setting up an FTPS server, make sure you disable plain (unencrypted) FTP! ...


9

Powershell to disable SSL2 and SSL3: 2..3 | %{ New-ItemProperty -Path "HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL $_.0\Server" -Name Enabled -PropertyType "DWORD" -Value 0 -Force }


9

IIS is not required on any Windows system, unless you want to host web sites; the only exception is if you are using any server role which runs on web services (such as WSUS) or offers them (such as Certificate Services). However, if you actually have any dependency on IIS, Windows itself will warn you about this when you try to remove the role; if this is ...


8

To address the most basic part of your question: Yes, you can send commands to a Windows Server from a web interface using the PowerShell Web Access feature in Windows Server 2012 and 2012 R2. For what you want (linking a user control in a web page to the execution of a specific action on the server), you might want to look into executing PowerShell from ...


6

The trick would be to run the Apache and IIS on different ports (only one service can bind to one port at a time), though there's far from any guarantee that WSUS or ePO would work properly on non-standard ports. McAfee's support was correct in recommending not running the two things on the same server, though both pieces of software do have options for ...


6

This is a bug in Chrome. You can see in the code that Chrome maintains a list of registry controlled domains and that it needs updated as each gTLD is added. You can see in the effective_tld_names.dat file that the .care domain is not listed, though its listed for other browsers that use a more recent version of the Public Suffix List. This is what causes ...


5

'USERTrust RSA Certification Authority' is not recognized as a root CA on all platforms. So, the best option is use it as an intermediate CA, having a certificate signed by 'AddTrust External CA Root'. You can retrieve this certificate at http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt Proper installation (most accepted) of your certificate is: Root ...


5

Also check this answer from here: Cannot manually edit applicationhost.config The answer is simple, if not that obvious: win2008 is 64bit, notepad++ is 32bit. When you navigate to Windows\System32\inetsrv\config using explorer you are using a 64bit program to find the file. When you open the file using using notepad++ you are trying to open it using a 32bit ...


5

This is seems to be covered fairly well in install.txt included in the PHP zip downloads. Quoting from that file ... Manual Installation Steps ... Upgrading from a previous PHP version: Previous editions of the manual suggest moving various ini and DLL files into your SYSTEM (i.e. C:\WINDOWS) folder and while this simplifies ...


4

It seems that you are actually asking how to change HTTP ports in IIS. Open Internet Information Services (IIS) Manager (from Administrative tools) Connections pane: COMPUTER NAME Sites Default Web Site Actions pane: Edit Site Bindings... Just select the binding http->80 and edit it to meet your requirements. Repeat for any other sites bind ...


4

When you have IIS Manager open, you can click Help -> About to see the version.


4

There's a fairly good chance you're missing the correct VC++ runtime for the version of PHP you're running. If you're running PHP 5.5.x you need to ensure the VC++11 runtime is installed: http://www.microsoft.com/en-us/download/details.aspx?id=30679 Make sure you download and install the x86 version (vcredist_x86.exe), PHP on Windows isn't 64 bit yet. ...


4

In order to successfully install the PHP manager for IIS 8, you need the .NET 3.5 framework installed and enabled, and for some reason, that's not part of the setup, which does download the .NET 2.0 framework. So, just add the .NET 3.5 framework manually (you can do so through the "add features" wizard), and the your PHP manager should install properly. ...


4

IIS provides a certificate chain to the client using the certificates loaded in the server computer's registry. You need to obtain the missing intermediate certificate and install it onto the server so that it can provide a complete certificate chain to clients.


4

Here's a PowerShell that will test for the presence of the registry keys, create them if needed, and then enter the necessary values to disable SSL 2.0 and SSL 3.0 $regPath1 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL 2.0' $regPath2 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL ...


4

Open your IIS manager and select the directory you want to protect. Under the "IIS" section select "Authentication". Disable "Anonymous Auth". Enable the desired Auth method (usually "Basic Auth") and it will be valid for this directory only. Add a User account. Give that user Read, Execute, List Permissions on the directory needed, then login via the newly ...


4

In general, it's not a good idea to mix user data with application code. You should maintain these separately, as code lives better in a repo, while data lives in a DB or a "raw" storage system - very different ways of storing information. When you say "a ton" of documents, what does that mean? If you're looking at 100s of GBs in thousands of files, then a ...


3

The most likely problem is Windows Firewall. Configure it to allow port 8080 traffic. It allows port 80 by default when IIS is installed as a role, but it doesn't automatically configure itself if you change the port.


3

You need to know a lot more than you do, to be honest. Even if you had the output from all the tools, and knew where to look for things that can't be automated, what would you do with the information? In your position, I would hire a consultant. Some tools that I use for a generic Windows infrastructure assessment : NMap/ZenMap SpiceWorks (includes ...


3

MVC 5 Applications require the .NET Framework 4.5 or 4.5.1 and may require other libraries depending on what was used to develop the application. Windows Server 2008 SP2 is the oldest supported version, and it's highly recommended to use 2012 or 2012 R2 (as those natively support that version of .NET)


3

You can use Performance Monitor and Debug Diag to generate dumps on high memory use conditions, including IIS memory usage. Performance Monitor will let you track Asp.NET memory used (there are several counters there), and Debug Diag will let you capture user dumps based on performance counters. After Debug Diag processes a dump, it'll let you know ...


3

The reason for using an App Pool Identity is purely a matter of security. There is another name for this in Windows - they're also called "virtual accounts." The 'network service' and especially 'local machine' accounts have too much privilege by default. Local Machine has unrestricted access to the entire system, and Network Service has the ability to ...



Only top voted, non community-wiki answers of a minimum length are eligible